WristClaw - Smartwatch control channel for OpenClaw

• Analyzed: May 16, 2026, 2:41 PM
• Findings: 1
• Version: 0.1.1
• Hash: af511a151ffb83b0d87845c9e1a87bb3a300e4f7e3dd21f75e24f02f0a6a88be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'wristclaw' skill facilitates a bridge between an Apple Watch app and the OpenClaw agent, requiring high-privilege operations including a 'curl | bash' installation script from wristclaw.app (found in skill.md). It directs the agent to access sensitive user data such as calendars via the 'gog' CLI and location data via 'findmyloc', while routing communications through a third-party relay (wss://relay.wristclaw.app/ws). While these capabilities are plausibly needed for the stated purpose of a watch integration, the use of unverified remote execution and broad access to other system skills warrants a suspicious classification.